1. Field of the Invention
This invention relates to systems and methods for protecting computers. In particular, this invention relates to systems and methods for protection of computers and other devices from malicious code such as viruses, spyware, undesirable code, or the like.
2. Description of Related Art
Malicious codes such as viruses, worms, spyware, etc., can cause substantial damage to computers and other devices. Known systems that protect against malicious code are typically based on an analysis of a code before it is accepted by a computer. This analysis is usually based on a comparison of the code in question with a collection of known malicious codes contained in a “library.” If a substantial similarity is found between the code in question and a code in the library, the code is declared malicious or potentially malicious and is not accepted by the protected computer for further processing.
Detection of malicious code, such as a worm or virus, and a determination of the associated potentially devastating effects can be determined using a test chamber, such as that described in U.S. Pat. No. 5,842,002, incorporated herein by reference in its entirety.
A test chamber is a static hardware model of a protected system, such as a computer. Questionable code, such as an incoming e-mail message is placed in such a test chamber where the conditions of the actual protected system are simulated. A malicious code reacting to such simulated conditions would act according to its designed purpose in this environment. Most common types of such action would be destruction of computer files and/or replication and an attempt to spread the replicas to other computers within a given environment, such as over a LAN or via e-mail. Upon detection of such activities within the test chamber, or upon destruction of all or a portion of the test chamber, the code in question can be declared malicious and not forwarded to the protected computer.
In cases where malicious activity is not detected, the code is deemed safe and passed to the protected computer. For example, upon completion of a scan of an e-mail, and no malicious code within the e-mail detected, the e-mail can be forwarded to the protected computer.